Cyware Monthly Threat Intelligence
Monthly Threat Briefing • June 1, 2020
The Good
The entire world is in the middle of a pandemic and people are mostly working from their homes. Organizations around the globe are devising security measures against cyber threats to protect their virtual workspaces. For instance, last month, Google launched the ‘Scam Spotter’ program to help individuals tackle COVID-19 related scams whereas, Microsoft open-sourced its Coronavirus threat intel data for security researchers. Moreover, the Cybersecurity and Infrastructure Security Agency (CISA) has updated defensive measures in the wake of heightened attacks on healthcare organizations.
- Google, in association with the Cybercrime Support Network, launched a new ‘Scam Spotter’ program to help individuals spot and prevent COVID-19 related scams.
- The CISA improved defence measures for healthcare organizations and research facilities in an effort to protect Coronavirus-related research. The development comes as state-sponsored hackers continue to target Coronavirus-related medical research data.
- Germany-based Tutanota, a secure email service, is working with the L3S Research Institute of Leibniz University on a new project called PQmail. This project aims to keep email secure by using post-quantum cryptography for encryption.
- FIRST released an updated version of ‘The Guidelines for Multi-Party Vulnerability Coordination and Disclosure.’ The purpose of the guidelines is to improve coordination and communication across different stakeholders during a vulnerability disclosure.
- Microsoft open-sourced its threat intel collection to help the security community build protective solutions for users. The initiative was taken following the increase in Coronavirus-related cyber threats.
The Bad
Disarray caused by the pandemic has become a breeding ground for financially-motivated attacks, as implied by the Verizon 2020 Data Breach Investigations Report (DBIR). In one of the cases, hackers siphoned off data from different e-commerce sites and demanded $525 in Bitcoin for not disclosing it in public. Similarly, a group attacked Grubman Shire Meiselas & Sacks and held over 700 GB of its data to ransom. Meanwhile, Maze actors released the credit card details of the Bank of Costa Rica customers for not paying the ransom.
- Covve leaked 23 million email addresses and other personal details due to an unprotected Elasticsearch database. In total, the database contained 90GB of personal information.
- Around 31 SQL databases associated with several e-commerce sites were offered for sale on a public website. These databases contained 1.6 million rows of user information. Hackers demanded a ransom of $525 in Bitcoin, asking victims to recover their databases.
- A cybercriminal group stole around 756 GB of documents and correspondence belonging to high-profile personalities from Grubman Shire Meiselas & Sacks. Later, it claimed to auction the sensitive documents of the international singer, Madonna and the U.S. President.
- A threat actor leaked a trove of personal and electoral data belonging to 2.3 million Indonesian citizens. The data appeared to be stolen from the official website of the General Elections Commission of Indonesia.
- NTT disclosed a data breach that resulted in the compromise of data of about 600 customers. The hackers infiltrated the Active Directory services on May 7 to gain access to NTT’s sensitive data.
- Maze ransomware attacked the financial technology firm, Pitney Bowes. Though the company partially prevented the attack by avoiding file encryption, some of the firm’s data were stolen in the attack.
- Maze ransomware operators published credit card details of the Bank of Costa Rica (BCR) after a failed ransom demand. The hackers had exfiltrated the data in August 2019.
- More than 2,000 Israeli websites were defaced to show an anti-Israeli message. Attributed to a hacker group called ‘Hackers of Savior,’ the attacks were executed by exploiting a vulnerability in a WordPress plugin.
- CAM4 exposed over 4TB of Personally Identifiable Information (PII) of users via a misconfigured database over an unprotected server. The exposed PII included names, private conversations, and IP addresses of the users.
- Hackers sold records of 22 million Unacademy users after gaining access to their database. The database was put for sale at a price of $2000.
- Details of 44 million Pakistani mobile users were leaked online this week. The records included customers’ full names, home addresses, phone numbers, and National Identification Numbers.
New Threats
Greater threats surfaced last month due to rickety software and sophisticated malware capabilities. Security researchers discovered a new RangeAmp attack that could bring down websites and Content Delivery Networks (CDNs). Ako ransomware operators added a new tactic to extort more money from victims. Researchers also uncovered the new variants of many malware, including Astaroth, Zeus Sphinx, Dark Crystal RAT, and Anubis Trojan.
-
Two high-severity vulnerabilities found in the PageLayer plugin could let attackers wipe out the content and take control of WordPress sites. The plugin is installed on at least 120,000 sites.
-
A new form of DoS attack called RangeAmp can bring down websites and CDNs by amplifying web traffic. So far, there are two variants of the attack - RangeAmp Small Byte Range (SBR) and RangeAmp Overlapping Byte Ranges (OBR).
-
Ako ransomware operators evolved to add a new tactic in addition to the existing ‘naming and shaming’ strategy to force victim organizations into making extra ransom payments. The extra amount is for deleting the files from firms.
-
The capabilities of Grandoreiro trojan and Valak malware were enhanced to target Portuguese users and Microsoft Exchange servers, respectively. While the former was used to steal banking credentials, the later stole targeted enterprises’ credentials.
-
Netwalker ransomware evolved to include a reflective Dynamic-link Library (DLL) injection as one of its evasion techniques. The technique allows the injection of a DLL from memory rather than from the disk.
-
Academics from Germany and Italy found a new method to break the separation between Wi-Fi and Bluetooth technologies. The attack relies on a new class of vulnerability, named Spectra.
-
All computers manufactured before 2019 are affected by seven vulnerabilities found in Intel’s Thunderbolt hardware interface. Collectively known as Thunderspy, the flaws can allow attackers to gain physical access to devices and steal data from their hard drives.
-
Winnti hacker group targeted video game companies with a new PipeMon backdoor to achieve persistence. PipeMon’s first stage consists of a password-protected RARSFX executable embedded in the .rsrc section of its launcher.
-
Variants of malware such as Astaroth, Zeus Sphinx, Dark Crystal RAT, and Anubis Trojan were uncovered by researchers last month. While the new samples of Astaroth, Dark Crystal RAT, and Zeus Sphinx had anti-analysis techniques added to their modules, the new variant of Anubis, still under development, could allow attackers to gain granular insight into an infected device.
-
An attack campaign, dubbed Blue Mockingbird, was found exploiting a deserialization vulnerability (CVE-2019-18935) in the ASP.NET open-source web framework to deploy the XMRig Monero-mining payload on Windows systems. The campaign, which started in December 2019, lasted till April 2020.
-
A new variant of the SLocker Android malware infected user devices by disguising as ‘About Coronavirus’ app. In addition to this, threat actors updated the evasion capabilities of the EVILNUM Trojan that targeted the financial sector.